Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14019: A flaw was found in Open-iSCSI rtslib-fb through versions 2.1.72, where it has weak permissions for /etc/target/saveconfig.json because the shutil.copyfile, instead of shutil.copy is used, and permissions are not preserved upon editing. This flaw allows an attacker with prior access to /etc/target/saveconfig.json to access a later version, resulting in a loss of integrity, depending on their permission settings. The highest threat from this vulnerability is to confidentiality. 1854723: CVE-2020-14019 python-rtslib: weak permissions for /etc/target/saveconfig.json
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python-rtslib | 0:2.1.74-1.amzn2 |
| Amazon Linux · 2 | python-rtslib-doc | 0:2.1.74-1.amzn2 |
Vulnerabilities 1
-
High 7.8
rtslib-fb weak permissions for /etc/target/saveconfig.json file
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-14019.html